Integrate collaborative review identity and feedback

[soerennb]

Summary

This is the sanitized successor to #71. It carries the completed review UI and collaboration integration while preserving the current public main dependency, E2E, and workflow-policy baseline.

• Separate general feedback and pin conversations, contextual annotation placement, transform-only zoom/pan, and review-state labels.
• Account-aware collaboration actors with guest isolation, private feedback, selection recipient delivery, purge behavior, and additive migrations.
• Upgrade, smoke, unit, browser, localization, documentation, and CI coverage.
• Guest bootstrap requests no longer expire a concurrently created gallery-scoped session cookie.

Public-history safety

The branch was produced by the reviewed incremental public-history sanitizer with an explicit allowlist. .beads, .agents, AGENTS.md, internal graft files, and internal commit objects are not reachable from this branch. The existing public workflow-policy repair remains inherited from main.

Two clean sanitizer runs against public main produced the identical commit d2cc45763bc8eba9198fc0f39a25a1cb5c6e5c23; both history scans reported no leaks.

Validation

• npm run lint, npm test, npm run build, npm run build:docs
• composer lint, composer test (198 tests / 645 assertions), composer analyse
• SQLite, MariaDB, and PostgreSQL upgrade checks from 0.9.2
• Full Docker-backed Playwright suite: 53 passed, 2 intentional skips; guest-session regression repeated 5/5
• Public-main dependency baseline (@nextcloud/dialogs 7.5, Vitest 5, etc.) retained

Please merge this successor linearly. After it is merged, #71 can be closed as superseded.